prefect-cve-2026-5366

PoC: CVE-2026-5366 - Git Argument Injection in Prefect GitRepository Vulnerability: git argument injection leading to RCE via commitsha plus argument injection via directories Version: vulnerable in 3.6.23, fixed in 3.6.25+ File: src/prefect/runner/storage.py Huntr:...

CVE-2026-5366

Prefect version 3.6.23 is vulnerable to remote code execution due to improper handling of user-controlled input in the "GitRepository" storage class. The "commitsha" parameter, which is passed to git commands, lacks validation and does not include a "--" separator to distinguish user input from g...

CVE-2026-5366: Improper Control of Generation of Code

Prefect version 3.6.23 is vulnerable to remote code execution due to improper handling of user-controlled input in the GitRepository storage class. The commitsha parameter, which is passed to git commands, lacks validation and does not include a -- separator to distinguish user input from git...